timekit
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or obfuscation techniques were detected. The skill follows secure authentication patterns by using a centralized credential manager.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the official
@membranehq/clipackage from the npm registry, which is an expected dependency for this vendor. - [COMMAND_EXECUTION]: Instructions include using the
membraneCLI to execute actions and make proxy requests to the Timekit API. These are part of the intended functionality for scheduling automation. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted data from the Timekit API. 1. Ingestion points: Responses from
membrane action runandmembrane request(SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Command execution viamembraneCLI. 4. Sanitization: Absent.
Audit Metadata